Answers · bookkeeping
How do I keep a copy of my business's books that my bookkeeper or an employee can't edit?
Last updated
TL;DR: Your accounting software can't be that copy, because whoever has an admin role there can change it. An independent copy has three parts, each kept where the bookkeeper can't write. First, the bank's own statements, delivered to you directly. Second, the reports you export each month, saved to storage only you control. Third, a running record of each invoice, payment and adjustment, sealed as it happens to a ledger nobody can edit afterwards. In QuickBooks Online, keep the primary admin role yourself and give the bookkeeper a role that fits the work (the Bookkeeper role can't view the profit and loss or balance sheet, or add vendors), and read the audit log yourself. A Rightshold mirror ledger is one way to keep the third part. Each entry is hash-chained and has no edit or delete route, so a correction has to be a new entry. Hold the API key yourself. The copy doesn't stop anyone changing the books, but any later change shows when you compare the books against it.
What should I check, step by step?
1. Have the bank send statements to you: your own online banking login, a statement emailed to your own address, or paper mailed to you. The AICPA's examples of small-business controls list the owner receiving the bank statement at a personal address and reviewing it monthly.
- Keep the primary admin role in QuickBooks Online yourself. Only admins can add, edit or remove admins, and only the primary admin can change company info. Don't hand the bookkeeper your login.
- Give the bookkeeper the narrowest role that does the job. QuickBooks Online's Bookkeeper role can enter transactions and pay bills but can't view financial reports like the profit and loss or balance sheet, run payroll, or add, edit or delete vendors. Standard all access and In-house accountant can reconcile accounts and make journal entries, and In-house accountant can undo completed reconciliations.
- Don't use the View reports role as your own read-only seat. QuickBooks says it can't view the actual transactions or the audit log. Keep admin access so you can read the audit log yourself.
- Each month, after the books are reconciled, export the key reports (trial balance, general ledger detail, balance sheet, profit and loss, bank reconciliation reports) and save them to storage only you can write to. Hash them if you want to prove later that they're unchanged.
- Seal each invoice, payment and adjustment to a Rightshold mirror ledger as it happens, from a script or integration that uses an API key only you hold. Use your own invoice and customer references, not names or emails.
- Book corrections as new entries. The mirror has no edit or delete route, so a mistake is fixed with an adjustment or dispute_note entry that points at the original.
- Once a month, compare the three: the bank's statement, the mirror's entries for the month, and the books. Investigate anything in the books that isn't in the mirror or on the bank statement, or any mirrored entry that has changed in the books.
- Review payroll yourself. The AICPA's examples have the owner review each payroll report for phantom employees, unapproved overtime and unapproved raises, and approve every payroll change in writing.
- Keep the copy for as long as your tax records, not just two years. The QuickBooks Online audit log keeps events for two years.
Why can't my QuickBooks or Xero file be the copy of the books my bookkeeper can't edit?
Accounting software is built to be edited. QuickBooks Online's Standard all access and In-house accountant roles can reconcile accounts and make journal entries. The primary admin, In-house accountant users and accountants can undo a completed reconciliation, which permanently deletes its report. The audit log records who changed what and keeps events for two years.
- So a copy that only exists inside the same account depends on the people with admin roles. A copy the bookkeeper can't touch has to live somewhere else: with the bank, in your own storage, or with a third party that doesn't allow edits.
What goes into an independent copy of a small business's books?
The bank's statements are the best outside record of money in and out, as long as they come to you directly and not through the person who keeps the books.
- Monthly report exports freeze what the books said at close. QuickBooks Online can export reports and lists to Excel. Keep the files where the bookkeeper has no write access.
- A sealed running record covers the detail between closes: each invoice, payment and adjustment as it happened. That's what lets you spot a single changed invoice, not just a changed monthly total.
What does a Rightshold mirror ledger record, and who can change it?
A Rightshold mirror ledger is opened under a neutral label such as 'Service business #1', so the business isn't named publicly. Each entry records its type, your content (amounts in integer cents and your own references), the date you give (occurred_at) and Rightshold's seal time (sealed_at), and is hash-chained to the entry before it.
- The store rejects updates and deletes of sealed entries, and there is no edit route. Each entry's hash is also written to Rightshold's append-only public ledger, whose blocks are timestamped in Bitcoin through OpenTimestamps.
- Whoever holds the API key can add entries but not change them. Keep the key yourself, and have your accountant check entries by id with the free GET /v1/mirror-entries/{id} without needing your login.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Is the Rightshold ledger block that holds my latest mirror-ledger entry anchored in Bitcoin yet?”
{
"tool": "ledger_anchor",
"arguments": {
"height": "<anchor.block_height from GET /v1/mirror-entries/{id}>"
}
}- Free, no key (MCP toolset=ledger). It returns the anchor status per OpenTimestamps calendar and the .ots proof to check with ots verify.
- The mirror ledger is a REST API with an API key you hold: POST /v1/mirror-ledgers opens one under a neutral label, and POST /v1/mirror-ledgers/{id}/entries seals an invoice, adjustment, payment, tip_allocation, tip_payout or dispute_note entry. Amounts are integer cents.
- GET /v1/mirror-ledgers/{id}/entries (owner key) lists your entries with seq, occurred_at, sealed_at and entry_hash. GET /v1/mirror-entries/{id} is free and needs no account: the record as sealed, its chain check and its anchor status.
- ledger_verify (free, no key) recomputes every hash, Merkle root, chain link and signature on Rightshold's ledger.
- Content with names, emails, phone numbers, addresses or tax ids is refused. Use your own references (customer_ref, worker_ref).
Rightshold doesn't connect to QuickBooks, Xero or your bank, and it doesn't do bookkeeping or check your numbers. The mirror proves what was sealed and when. It doesn't stop anyone editing your accounting software, it can't see records nobody sealed, and it can't show a sealed record was accurate. Setting user roles, receiving statements and comparing the records are steps you run. Not legal, tax, audit or accounting advice.
What are the sources?
- AICPA: Examples of Controls in Small Entities (owner receives the bank statement, reviews payroll for phantom employees)
- QuickBooks Online: User roles and access rights
- QuickBooks Online: Use the audit log (events available for two years)
- QuickBooks Online: Undo or remove transactions from reconciliations
- QuickBooks Online: Export your QuickBooks Online data
- IRS: How long should I keep records?
- OpenTimestamps: calendar-anchored timestamp proofs
Related
- How to prove small business books weren't edited after the fact
- Signs someone is hiding theft in your bank reconciliation
- How to catch backdated entries posted into a closed month after month-end close
- How can a CPA audit what an AI agent did in the books?
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'